CVE-2022-23959
Fixed in a distro release EPSS 2%
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.
Products: varnish-software varnich_cache, varnish-software varnish_cache, varnish-software varnish_cache_plus, varnish_cache_project varnish_cache, fedoraproject fedora, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | varnish | 6.0.8-1.module_el8.5.0+2620+03a0c2cc.1 |
| AlmaLinux 8 | varnish | 6.0.8-1.module_el8.5.0+76+a10ffa55 |
| AlmaLinux 8 | varnish-devel | 6.0.8-1.module_el8.5.0+76+a10ffa55 |
| AlmaLinux 8 | varnish-devel | 6.0.8-1.module_el8.5.0+2620+03a0c2cc.1 |
| AlmaLinux 8 | varnish-docs | 6.0.8-1.module_el8.5.0+2620+03a0c2cc.1 |
| AlmaLinux 8 | varnish-docs | 6.0.8-1.module_el8.5.0+76+a10ffa55 |
| AlmaLinux 8 | varnish-modules | 0.15.0-6.module_el8.5.0+2620+03a0c2cc |
| AlmaLinux 8 | varnish-modules | 0.15.0-6.module_el8.5.0+76+a10ffa55 |
| Alpine 3.12 | varnish | 6.5.2-r1 |
| Alpine 3.13 | varnish | 6.5.2-r1 |
| Alpine 3.14 | varnish | 6.6.2-r0 |
| Alpine 3.15 | varnish | 7.0.2-r0 |
| Alpine 3.16 | varnish | 7.0.2-r0 |
| Alpine 3.17 | varnish | 7.0.2-r0 |
| Alpine 3.18 | varnish | 7.0.2-r0 |
| Alpine 3.19 | varnish | 7.0.2-r0 |
| Alpine 3.20 | varnish | 7.0.2-r0 |
| Alpine 3.21 | varnish | 7.0.2-r0 |
| Alpine 3.22 | varnish | 7.0.2-r0 |
| Alpine 3.23 | varnish | 7.0.2-r0 |
| Alpine 3.24 | varnish | 7.0.2-r0 |
| Debian 10 | varnish | 6.1.1-1+deb10u3 |
| Debian 11 | varnish | 6.5.1-1+deb11u2 |
| Debian 12 | varnish | 7.1.0-5 |
| Debian 13 | varnish | 7.1.0-5 |
| Debian 9 | varnish | 5.0.0-7+deb9u3 |
| Red Hat Enterprise Linux 8 | varnish | 0:6.0.8-1.module+el8.5.0+14089+03a0c2cc.1 |
| Red Hat Enterprise Linux 8 | varnish-devel | 0:6.0.8-1.module+el8.5.0+14089+03a0c2cc.1 |
| Red Hat Enterprise Linux 8 | varnish-docs | 0:6.0.8-1.module+el8.5.0+14089+03a0c2cc.1 |
| Red Hat Enterprise Linux 8 | varnish-modules | 0:0.15.0-6.module+el8.5.0+11976+0b4af72d |
| Red Hat Enterprise Linux 8 | varnish-modules-debuginfo | 0:0.15.0-6.module+el8.5.0+11976+0b4af72d |
| Red Hat Enterprise Linux 8 | varnish-modules-debugsource | 0:0.15.0-6.module+el8.5.0+11976+0b4af72d |
| Red Hat rhel e4s 8.1 | varnish | 0:6.0.2-2.module+el8.1.0+14093+aa8ea65f.1 |
| Red Hat rhel e4s 8.1 | varnish-devel | 0:6.0.2-2.module+el8.1.0+14093+aa8ea65f.1 |
| Red Hat rhel e4s 8.1 | varnish-docs | 0:6.0.2-2.module+el8.1.0+14093+aa8ea65f.1 |
| Red Hat rhel e4s 8.1 | varnish-modules | 0:0.15.0-4.module+el8+2481+4078e9d2 |
| Red Hat rhel e4s 8.1 | varnish-modules-debuginfo | 0:0.15.0-4.module+el8+2481+4078e9d2 |
| Red Hat rhel e4s 8.1 | varnish-modules-debugsource | 0:0.15.0-4.module+el8+2481+4078e9d2 |
| Red Hat rhel eus 8.2 | varnish | 0:6.0.2-2.module+el8.2.0+14091+b587eafb.1 |
| Red Hat rhel eus 8.2 | varnish-devel | 0:6.0.2-2.module+el8.2.0+14091+b587eafb.1 |
| Red Hat rhel eus 8.2 | varnish-docs | 0:6.0.2-2.module+el8.2.0+14091+b587eafb.1 |
| Red Hat rhel eus 8.2 | varnish-modules | 0:0.15.0-4.module+el8+2481+4078e9d2 |
| Red Hat rhel eus 8.2 | varnish-modules-debuginfo | 0:0.15.0-4.module+el8+2481+4078e9d2 |
| Red Hat rhel eus 8.2 | varnish-modules-debugsource | 0:0.15.0-4.module+el8+2481+4078e9d2 |
| Red Hat rhel eus 8.4 | varnish | 0:6.0.6-2.module+el8.4.0+14090+331e4860.2 |
| Red Hat rhel eus 8.4 | varnish-devel | 0:6.0.6-2.module+el8.4.0+14090+331e4860.2 |
| Red Hat rhel eus 8.4 | varnish-docs | 0:6.0.6-2.module+el8.4.0+14090+331e4860.2 |
| Red Hat rhel eus 8.4 | varnish-modules | 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc |
| Red Hat rhel eus 8.4 | varnish-modules-debuginfo | 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc |
| Red Hat rhel eus 8.4 | varnish-modules-debugsource | 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc |
| Red Hat rhel software collections 3 | rh-varnish6-varnish | 0:6.0.8-2.el7.1 |
| Red Hat rhel software collections 3 | rh-varnish6-varnish-devel | 0:6.0.8-2.el7.1 |
| Red Hat rhel software collections 3 | rh-varnish6-varnish-docs | 0:6.0.8-2.el7.1 |
| Red Hat rhel software collections 3 | rh-varnish6-varnish-libs | 0:6.0.8-2.el7.1 |
| Rocky Linux 8 | varnish | 0:6.0.8-1.module+el8.5.0+736+fec10e21.1 |
| Rocky Linux 8 | varnish | 0:6.0.8-1.module+el8.5.0+677+2a78a869 |
| Rocky Linux 8 | varnish-modules | 0:0.15.0-6.module+el8.5.0+677+2a78a869 |
| SUSE Package Hub 15 SP3 | varnish | 7.1.0-bp153.2.3.1 |
| Ubuntu 14.04 LTS | varnish | no fix |
| Ubuntu 18.04 LTS | varnish | 5.2.1-1ubuntu0.1 |
| Ubuntu 20.04 LTS | varnish | 6.2.1-2ubuntu0.1 |
| Ubuntu 22.04 LTS | varnish | 6.6.1-1ubuntu0.2 |
| Ubuntu 24.04 LTS | varnish | no fix |
| Ubuntu 25.10 | varnish | no fix |
| Ubuntu 26.04 LTS | varnish | no fix |
| Ubuntu 26.10 | varnish | no fix |
| Ubuntu Pro 16.04 LTS | varnish | no fix |
| openSUSE Leap 15.3 | varnish | 7.1.0-bp153.2.3.1 |
| openSUSE Tumbleweed | varnish | 7.1.0-1.1 |
| openSUSE Tumbleweed | vinyl-cache | 9.0.0-1.1 |